CVE-2026-110248CWE-532

CVE-2026-110248

Medium · published October 14, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because the runclone_command() function does not redact credentials from subprocess error output.

To remediate this issue, users should upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
6.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00531 · 44.0th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-10-14T23:17Z
References (4)
https://aws.amazon.com/security/security-bulletins/2026-134-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-g6w4-jvgp-68x2 · ff89ba41-3aa1-4d27-914a-91399e9639e5https://pypi.org/project/sagemaker/2.257.3/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://pypi.org/project/sagemaker/3.10.0/ · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 16 OCT 03:27Z
    EPSS moved — → 1%
    epss
  • 14 OCT 18:34Z
    Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py
    cvelistv5
  • 14 OCT 18:34Z
    Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py
    cvelistv5